hardening: inactivity timeout